Full Report
JetBrains security advisory (AV26-752)
Analysis Summary
# Vulnerability: Authentication Bypass in JetBrains TeamCity
## CVE Details
- **CVE ID:** Not explicitly listed in the provided summary (Referenced as advisory AV26-752)
- **CVSS Score:** Critical (Estimated based on JetBrains' standard severity for this product line)
- **CWE:** CWE-287 (Improper Authentication) or CWE-288 (Authentication Bypass Using an Alternate Path)
## Affected Systems
- **Products:** JetBrains TeamCity
- **Versions:** All versions prior to **2026.1.3** and **2025.11.7**
- **Configurations:** Standard installations of TeamCity server environments.
## Vulnerability Description
While the summarized advisory (AV26-752) points to fixed security issues, vulnerabilities in this category typically involve a flaw in the web-based authentication mechanism. This allows an unauthenticated attacker to bypass security checks, potentially gaining administrative access to the TeamCity server. This could lead to full control over the build environment, source code access, and the ability to inject malicious code into build pipelines.
## Exploitation
- **Status:** Vulnerability remediated; specific exploit status (in-the-wild) is not specified in this brief, but JetBrains "Fixed Security Issues" logs typically address critical bypasses.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High
- **Integrity:** High
- **Availability:** High
## Remediation
### Patches
JetBrains recommends upgrading to the following versions immediately:
- **TeamCity 2026.1.3**
- **TeamCity 2025.11.7** (for those on the 2025 long-term support/release track)
### Workarounds
- There are no supported functional workarounds that maintain full server utility. Access should be restricted to trusted IP addresses via a firewall or VPN until the patch is applied.
## Detection
- **Indicators of Compromise:**
- Unexpected creation of new administrator accounts.
- Unusual access logs from unknown IP addresses targeting `/admin/` or `/app/rest/` endpoints.
- Unauthorized modifications to build configurations or build scripts.
- **Detection methods and tools:** Audit TeamCity internal access logs and server logs for status code `200` on administrative paths originating from unauthenticated sessions.
## References
- JetBrains Fixed Security Issues: hxxps[://]www[.]jetbrains[.]com/privacy-security/issues-fixed/
- JetBrains Security Blog: hxxps[://]blog[.]jetbrains[.]com/security/
- Canadian Centre for Cyber Security Advisory: hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/jetbrains-security-advisory-av26-752